Signed-cookie sessions are vulnerable to key injection because session state is serialized with a custom delimiter-based parser instead of a structured format

[hourianto]

https://github.com/planety/prologue/blob/devel/src/prologue/core/types.nim#L143

The function splits on :, ,, and } without escaping. Storing alice, is_admin: true in one session field (e.g. user) round-trips as two fields (user=alice, is_admin=true)

Found by GPT 5.4.